stix2-patterns
Validate STIX 2 Patterns.
Decision gist · record as of 2026-08-14
Yes, with conditions. The package fills a specific need for STIX 2 Pattern validation in CTI workflows and has no known vulnerabilities. However, the aging maintenance status (184 days since last release) and Alpha development status mean you should verify that it handles your specific pattern syntax correctly and be prepared to maintain a fork if critical bugs emerge. Suitable for production use in established CTI systems where pattern validation is a non-critical component.AI-flagged interpretation of the facts on this page — verify before relying
Before you install
- Requires Python 3.10 or later.
- The antlr4-python3-runtime dependency is installed automatically.
- Low install friction with a single runtime dependency (antlr4-python3-runtime).
License · maintenance · safety
permissive license (permissive) — Licensed under BSD-3-Clause (permissive), an OASIS TC Open Repository license. Permissive terms mean you can use, modify, and distribute the package freely in commercial or private projects with minimal restrictions.
last release 2026-02-11 (184 days) · last repo commit 2026-02-11 · 29 stars
0 known vulnerabilities (OSV.dev, 2026-08-14) · 1,856,469 downloads/mo, #3,488 on PyPI
Alternatives
Verify before relying
pip install stix2-patterns
from stix2patterns.validator import run_validator
pattern = "[file-object:hashes.md5 = '79054025255fb1a26e4bc422aef54eb4']"
errors = run_validator(pattern)- Whether the aging maintenance status (184 days since last release) affects stability or introduces unfixed bugs in pattern validation.
- Real-world accuracy and completeness of STIX 2 Pattern syntax validation against the full OASIS specification.
- How the package handles edge cases and malformed patterns in production CTI workflows.
What it is and what it does
stix2-patterns is a validator for STIX 2 Pattern expressions—the formal language used in cyber threat intelligence to describe observable conditions that indicate threat activity. It parses pattern syntax against an ANTLR grammar and reports whether a given pattern is well-formed. The package is maintained by the OASIS Cyber Threat Intelligence Technical Committee and can be used either as a standalone command-line tool or imported into Python applications to programmatically validate patterns.
The validator's main dependency is antlr4-python3-runtime, which provides the parser infrastructure. It supports Python 3.10 and later, with a development status of Alpha. The tool is useful for anyone building CTI systems, threat feeds, or security applications that need to ensure pattern expressions are syntactically correct before processing them downstream.
Use it for
- Validate STIX patterns in a threat intelligence platform before storing or distributing them to ensure they are well-formed.
- Integrate pattern validation into a security tool's data pipeline to reject malformed observable conditions early.
- Build a CTI data quality checker that scans threat feeds for syntactically invalid STIX patterns.
- Test STIX pattern expressions programmatically in unit tests for threat detection rules or detection-as-code systems.
- Provide pattern syntax validation as part of a threat intelligence data ingestion workflow.
Worth the install?
AI-flagged interpretation of the facts on this page. Verify before relying on it.
Yes, with conditions.
The package fills a specific need for STIX 2 Pattern validation in CTI workflows and has no known vulnerabilities. However, the aging maintenance status (184 days since last release) and Alpha development status mean you should verify that it handles your specific pattern syntax correctly and be prepared to maintain a fork if critical bugs emerge. Suitable for production use in established CTI systems where pattern validation is a non-critical component.
Install
stix2-patterns on PyPI
Before you install
Low install friction with a single runtime dependency (antlr4-python3-runtime). Maintenance status is aging—last release was 184 days ago—but the repository remains active and the package supports current Python versions (3.10 through 3.14).
Requires Python 3.10 or later. The antlr4-python3-runtime dependency is installed automatically.
License in practice
Licensed under BSD-3-Clause (permissive), an OASIS TC Open Repository license. Permissive terms mean you can use, modify, and distribute the package freely in commercial or private projects with minimal restrictions.
Quickstart
pip install stix2-patterns
from stix2patterns.validator import run_validator
pattern = "[file-object:hashes.md5 = '79054025255fb1a26e4bc422aef54eb4']"
errors = run_validator(pattern)Verify before relying
- Whether the aging maintenance status (184 days since last release) affects stability or introduces unfixed bugs in pattern validation.
- Real-world accuracy and completeness of STIX 2 Pattern syntax validation against the full OASIS specification.
- How the package handles edge cases and malformed patterns in production CTI workflows.
Package facts
| License | permissive license permissive |
| Python support | Supports the current Python release >=3.10 |
| Install friction | Low. Pure-Python wheel |
| Runtime dependencies | 1 packageantlr4-python3-runtime |
| Maintenance | Aging 184 days since the last release |
| Last repo commit | |
| First released | |
| Downloads | 1,856,469 / month, #3,488 on PyPI 30-day window, as of 2026-08-14 |
| Known vulnerabilities | None known OSV.dev, checked 2026-08-14 |
| Classifiers | Development Status :: 3 - AlphaLicense :: OSI Approved :: BSD LicenseProgramming Language :: Python :: 3Programming Language :: Python :: 3.10Programming Language :: Python :: 3.11Programming Language :: Python :: 3.12Programming Language :: Python :: 3.13Programming Language :: Python :: 3.14 |
Evidence: stix2_patterns-2.1.2-py2.py3-none-any.whl
Tags
Let your AI agent find packages like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 14,416 PyPI packages by what they can do, searchable in plain language.
wish › “stix pattern validation”
- stix2-patternsValidates the syntax of STIX 2 Pattern expressions used in cyber…
- stix2-validatorValidates STIX 2.x JSON documents against the STIX 2.1 specification,…
- stix2Serializes and deserializes STIX 2 JSON content, providing Python…
Give your agent the search over MCP, or paste the wish link into any chat.
More Security packages
Provides Python bindings to the FreeDesktop.org Secret Service API for securely storing and retrieving passwords and secrets through GNOME Keyring, KWallet, or KeePassXC.
MSAL for Python handles OAuth2 and OpenID Connect authentication with Microsoft identity services, managing token acquisition, caching, and refresh for applications integrating with Microsoft Entra ID, Microsoft Accounts, and Azure AD B2C.
joserfc implements JOSE standards (JWS, JWE, JWK, JWT, and related RFCs) for signing, encrypting, and managing JSON-based cryptographic tokens in Python.
Authlib provides a complete implementation of OAuth 1.0, OAuth 2.0, and OpenID Connect 1.0 for building both authentication clients and servers, with built-in support for JWS, JWK, JWA, and JWT standards.
Provides low-level CFFI bindings to the official Argon2 password hashing algorithm for use by libraries and applications that need direct access to Argon2 without higher-level abstractions.
ADAL for Python authenticates applications with Azure Active Directory to obtain tokens for accessing Azure AD-protected resources.
Install only if maintaining existing code that already depends on it, and plan a migration.
See also stix2 · stix2-validator · stix · taxii2-client · cybox · mixbox · pyspdx · iregexp-check · threatwire · license-expression